This invention relates generally to methods and systems for authenticating users over networks, and more particularly, to methods and systems of authenticating users over networks that increase the security of network-based transactions and thus reduce risks associated with such transactions.
Websites are generally established by entities on networks such that users are able to navigate to the websites to conduct site appropriate network-based transactions. As long as user information used to conduct network-based transactions on websites remains secret, such network-based transactions may be safely conducted without compromising the security of data that is accessible through the website, and without compromising privileged information of users. However, risks that such network-based transactions may be conducted fraudulently have increased due to password misuse, such as password sharing with untrustworthy third parties, and due to sophisticated techniques, such as phishing, developed by third parties to surreptitiously obtain user passwords. By obtaining user passwords, third parties are able to obtain information about individual users, and entities such as financial institutions, hospitals and national militaries. Such information may include social security numbers, credit card numbers, bank account numbers, private patient medical records and sensitive national military secrets. Third parties may use such information to conduct fraudulent network-based transactions with financial institutions and other commercial entities, blackmail patients to keep medical records confidential, and to anticipate and counter national military strategies.
Known authentication techniques that typically require users to enter the same unique username and the same unique password each time the web site is accessed may not adequately protect against fraudulently conducting network-based transactions and fraudulently accessing network accessible data, and thus may expose users and entities to increased network-based transactional risks. Consequently, it has been known to supplement such known authentication techniques with other authentication techniques by installing additional identification information on software or hardware tokens. However, generating the tokens themselves, constructing enrollment sites and systems for collecting enrollment information from users, procuring software and hardware to support token use, and maintaining such software and hardware systems is complex, expensive and time consuming.